PfBlockerNG v2.0 w/DNSBL
-
When you see "200 ok", that means that the file was downloaded successfully… So the issue is in the parsing of the file...
How many Lists did you select in the Reputation Tab - IQRisk Select Menu?
If you are using Country Blocking and other lists, it could also be that the IPs are duplicates which could report "1.1.1.1" which is an empty file placeholder... Maybe try to move the IQRisk as the first pfBNG Alias and execute a "Force Reload"...
-
Currently 20 in the list.
I lower it to 1 option and added the IQRISK to the top, disabled all CC and other IPv4 lists
Going to try a reinstall on this plugin to see if it helps
Output from Cron:
===[ Continent Process ]============================================
===[ IPv4 Process ]=================================================
[ ETIQRisk ] Downloading update .. 200 OK.. completed ..
Empty file, Adding '1.1.1.1' to avoid download failure.===[ Aliastables / Rules ]==========================================
No changes to Firewall rules, skipping Filter Reload
Updating: pfB_ETIQRisk
no changes.===[ FINAL Processing ]=====================================
cat: /var/db/pfblockerng/original/Block: No such file or directory
cat: All_custom.orig: No such file or directory
[ Original IP count ] [ 32 ]===[ Deny List IP Counts ]===========================
1 total
1 /var/db/pfblockerng/deny/ETIQRisk.txt====================[ Empty Lists w/1.1.1.1 ]==================
ETIQRisk
====================[ Last Updated List Summary ]==============
Jan 22 21:06 ETIQRisk
IPv4 alias tables IP count
–---------------------------
1IPv6 alias tables IP count
0
Alias table IP Counts
1 /var/db/aliastables/pfB_ETIQRisk.txt
pfSense Table Stats
table-entries hard limit 2000000
Table Usage Count 3725UPDATE PROCESS ENDED [ 01/22/16 21:07:30 ]
-
It's hard to troubleshoot without being able to test the file. I sent you a PM, if you are interested to do a TeamViewer session, I can see it live and be able to sort it out for you.
-
BBcan177 has fixed this issue!
-
Hi all
I seem to have a misconfiguration with the DNSBL. Specifically when Google tries to throw ads at me from their subsidiary Doubleclick I keep getting invalid certificate errors. Inspecting the certificate shows it looks like a generic certificate with all the default values you would expect from someone just hitting "OK" or something.
I've had a search around and I can't seem to find what's causing it.
Any suggestions?
-
Hi
Today I have one MX host blocked. E-mail on queue, not ping, not telnet.
The host was smtp.one2one.com.br (192.99.8.87)
I look for it on pfBlockerNG (v2.04) alerts, on system logs/firewall, and on states.
not found.
but when I disable pfBlockerNG I was able to send the messages. (ping, telnet)Now I enable pfBloquerNG again, and that IP are blocked again.
How can I supress that IP?
Thanks. -
Did you enable DNSBL ? Maybe it is the domain that is blocked. You should be able to see it in the pfBlockerNG: Alerts.
If it is the IP that is blocked, you should normally see it in pfBlockerNG: Alerts as well as in the Status: System logs: Firewall
Do you have Suppression enabled in the pfBlockerNG: General Settings? Read the instructions there and update the pfBlockerNGSuppress Alias to include that ip.
-
Did you enable DNSBL ? Maybe it is the domain that is blocked. You should be able to see it in the pfBlockerNG: Alerts.
Hi, no, no DNSBL.
If it is the IP that is blocked, you should normally see it in pfBlockerNG: Alerts as well as in the Status: System logs: Firewall
I know that, but the blocked IP are none on ALERTS or System Logs/Firewall
-
I know that, but the blocked IP are none on ALERTS or System Logs/Firewall
Did you enable logging in the pfBlockerNG: IPv4 Alias/List Configuration: Edit form for each Alias?
-
Found the problem
I have one pfB_Mail ipv4 list that block 192.99.0.0/16 and one allow list with the 192.99.8.87 IP
With version 1 it was working, but after v 2.04 update the IP was blocked.
I change the rules order and now are working.
Thanks. -
Hi,
Is it possible to use DNSBL and block sites for a IP range (for exemple 192.168.0.100-192.168.0.120)?
Thanks.
-
Hi,
Is it possible to use DNSBL and block sites for a IP range (for exemple 192.168.0.100-192.168.0.120)?
Thanks.
To bypass DNSBL, set those particular LAN devices to use a different DNS Server, or goto the Alerts Tab and suppress the domains that you want to allow.
-
OK - I'm feeling like an idiot.
I've gone through the thread on this, read posted instructions, un and re-installed pfblocker, made sure pfsense was current, made sure squid and squidguard were current, and even completely wiped to factory and reinstalled and reconfigure the pfsense, and while I can get pfblocker to isntall and configure and download lists without errors, and the auto-generated firewall rules SEEM to be updated with IP addresses, the service persists in showing itself as "down" instead of running.
Am I missing something? I'm not using the DNS features - just the IP block ones and country based block lists.
-
Greetings,
I am new to PFblockerNg, but started running based on a recommendation from a friend. I am using a Supermicro D525 server with PFsense 2.2.6 64-bit.
Issues:
1. The first time I installed and configured PFBlocker, the following issues showed up:
- No entries were added under either the Firewall or Aliases –> URLs.
- On reboot of the firewall, NTPD did not automatically start. (Neither did pfBlockerNG DNSBL Web Server)
2. Uninstalled
3. Reinstalled and reconfigured the package.
4. Issues encountered this time:
- Firewall and Aliases --> URLs rules were added
- NTPD <u>does not automatically</u> startup when firewall is rebooted and must be started manuallyDoes anyone have any ideas on how to address these issues? My configuration matches the configuration being used on a WatchGuard X700 running pfsense 2.2.4 32-bit.
I am not sure if there are additional logs that I need to provide for troubleshooting purposes?
Thanks!
capedcrsdr -
Hi dgarsys/capedcrsdr,
To use DNSBL make sure that you are using the DNS Resolver (Unbound) as the DNS service. Also ensure that you have defined the DNSBL VIP and ports in the DNSBL Tab.
Also note, that you need to run "Force Update" in the Update tab for the settings to be executed.
-
Not using DNSBL - that's not activated, just the pfblock stuff.
-
Not using DNSBL - that's not activated, just the pfblock stuff.
Once you install pfBlockerNG, the service will show as "Down" since DNSBL is not enabled. If you don't use DNSBL, then you can safely ignore the downed state. I haven't figured out a way to remove the DNSBL service when its not enabled.
-
OK. Thank you BB.
I WAS missing something.
Now to verify Squidguard and PFblock are actually working. I can do that tomorrow.
-
Is anyone using DNSBL & SquidGuard at the same time? Would this be considered redundant?
Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering. Previously we used Shalla's Black List in SquidGuard to selectively block content by category. Is something like this possible in DNSBL & perhaps I'm just missing it?
If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?
Thank you for your thoughts on this!
Best-
-
Is anyone using DNSBL & SquidGuard at the same time? Would this be considered redundant?
Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering. Previously we used Shalla's Black List in SquidGuard to selectively block content by category. Is something like this possible in DNSBL & perhaps I'm just missing it?
If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?
Hi darrenkdean,
There is no issue with Squid and DNSBL running at the same time… DNSBL is primarily a lite-weight solution to block 'Malicious Domains' and ADvert servers without adding the issues of running a proxy...
Currently, DNSBL does not block sub-domains. So if ads.yahoo.com is in a DNSBL blocklist, its not appropriate to block yahoo.com by adding the following, as it will obviously create issues…
local-zone: "yahoo.com" redirect local-data: "yahoo.com 60 IN A 10.10.10.1"
Its possible to use a list like Shallalist or dsi.ut-capitole.fr in DNSBL, by downloading the feed into /var/db/pfblockerng and extracting it into a subfolder. You can then manually add each category as a "localfile" in DNSBL.
The DNSBL blocklist will also require both "example.com" and "www . example.com" to be added. Here is a patch to auto add "www" to each domain.
https://forum.pfsense.org/index.php?topic=86212.msg581562#msg581562Hope that helps!
